IN THE CLAIMS: 

Claims 1-6, 9-15, 18-23, arid 26-33 are amended. No claims are cancelled or added. 
All pending claims and their present status are produced below. 



1 1 . (Currently amended) A method for providing [[a]] unique id e ntification 

2 identifications of monitored network data instances flowing across various 

3 connections between networked devices, the unique id e ntification identifications 

4 being derived from information contained entirely within each instance of the 

5 network data, the method comprising: 

6 using at l e ast on e a monitoring device to monitor a network data instance flowing 

7 across at l e ast one a data connection; 

8 deriving from the data instance certain information which collectively provides a 

9 unique identification of the network data instance; 

10 assembling the derived information into an input string for a hash function; and 

1 1 using fee an output string of the hash function as a signature which represents a 

12 unique identifier of the network data instance. 

1 2. (Currently amended) The method according to Claim 1, wherein the deriving step 

2 includes: 

3 deriving from the data instance a source and destination address for the data instance ; 

4 deriving from the data instance a source and destination port associated with the 

5 x networked devices; and 

6 deriving from the data instance at l e ast on e a sequence number associated with data 

7 instance. 
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1 3. (Currently amended) The method according to Claim 1 , which further includes: 
* 2 attaching the signature to at l e ast on e a data report associated with the network data 

3 instance; and 

4 transmitting the data r e ports report and the signatur e s signature from eaefe the 

5 monitoring device to a central collecting device. 

1 4. (Currently amended) The method according to Claim 3 , wherein a timestamp is 

2 further associated with eaeh the data report before it is transmitted to the central 

3 coll e ctor collecting device . 

1 5. (Currently amended) The method according to Claim 3 5 wherein the central 

2 collecting device uses the signatur e s signature to eliminate duplicate data reports that 

3 might come in from different monitoring devices positioned at different locations on 

4 the a network. 

1 6. (Currently amended) The method according to Claim [[!]] 2, wherein the network 

2 data instances are include data packets as part of a TCP/IP (Transmission Control 

3 Protocol/Internet Protocol) client-server network. 

1 7. (Original) The method according to Claim 6, wherein the source and destination 

2 addresses include a client IP address and a server IP address. 

1 8. (Original) The method according to Claim 7, wherein the source and destination port 

2 include a client port number and a server port number. 

1 9. (Currently amended) The method according to Claim 2, wherein the at l e ast on e 

2 sequence number includes a client sequence number or a server sequence number. 
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1 10. (Currently amended) The method according to Claim 9, wherein the at l e ast on e 

2 sequence number includes both a client sequence number and a server sequence 

3 number. 

1 11. (Currently amended) The method according to Claim [[2]] I, wherein the input string 

2 informatio n does not include a sequence numb e rs number . 

1 12. (Currently amended) The method according to Claim [[11]] I, wherein the network 

2 data instances are include datagrams as part of a UDP/IP (User Datagram 

3 Protocol/Internet Protocol) network. 

1 13. (Currently amended) The method according to Claim 1, which further includes [[:]] 

2 truncating the signature to include fewer bits than the hash function output string. 

1 14. (Currently amended) The method according to Claim 1, which further includes [[:]] 

2 adding flag bits to the signature which indicate the a type of application associated 

3 with the network data instance. 

1 1 5. (Currently amended) The method according to Claim 3, wherein the monitor 

2 monitoring device serves as a data reduction device for data report and signature 

3 information being sent to the central data coll e ctor collecting device . 

1 16. (Original) The method according to Claim 1 , wherein the monitoring device operates 

2 to directly monitor the network data. 

1 17. (Original) The method according to Claim 1, wherein the monitoring device operates 

2 to indirectly monitor the network data. 

1 18. (Currently amended) An apparatus for providing [[a]] unique id e ntification 

2 identifications of monitored network data instances flowing across various 

3 connections between networked devices, the unique id e ntification identifications 
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4 being derived from information contained entirely within each instance of the 

5 network data, the apparatus comprising: 

6 at l e ast on e a monitoring device positioned to monitor a network data instance 

7 flowing across at l e ast on e a data connection; 

8 a hash function device having an input string and an output string, the input string 

9 assembled from certain information derived from the network data instance, 

10 the information collectively providing a unique identification of the network 

1 1 data instance; 

12 wherein the output string is used as a signature which represents a unique identifier of 

13 the network data instance. 

1 19. (Currently amended) The apparatus according to Claim 18, wherein the information 

2 derived from the network data instance includes at least: 

3 a source and destination address derived from the network data instance; 

4 a source and destination port associated with the networked devices; and 

5 at l e a s t on e a sequence number associated with network data instance. 

1 20. (Currently amended) The apparatus according to Claim 18, which further includes: 

2 at l e ast on e a data report associated with the network data instance, the signature 

3 being attached to the data report; and 

4 a central collection device that receives transmitt e d the data r e port s report and 

5 signatures the signature from eaeh the monitoring device. 

1 21. (Currently amended) The apparatus according to Claim 20, wherein a timestamp is 

2 further associated with eaeh the data report before it is transmitted to the central 

3 coll e ctor collection device . 
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1 22. (Currently amended) The apparatus according to Claim 20, wherein the central 

* 2 coll e cting collection device uses the signatur e s signature to eliminate duplicate data 

3 reports that might come in from different monitoring devices positioned at different 

4 locations on fee a network. 

1 23. (Currently amended) The apparatus according to Claim 19, wherein the network data 

2 instances are include data packets as part of a TCP/IP (Transmission Control 

3 Protocol/Internet Protocol) client-server network. 

1 24. (Original) The apparatus according to Claim 23, wherein the source and destination 

2 addresses include a client IP address and a server IP address. 

1 25. (Original) The apparatus according to Claim 24, wherein the source and destination 

2 port include a client port number and a server port number. 

1 26. (Currently amended) The apparatus according to Claim 25, wherein the at l e ast on e 

2 sequence number includes a client sequence number or a server sequence number. 

1 27. (Currently amended) The apparatus according to Claim 26, wherein the at l e ast on e 

2 sequence number also includes both a client sequence number and a server sequence 

3 number. 

1 28. (Currently amended) The apparatus according to Claim [[19]] 18, wherein the input 

2 string information does not include a sequence numb e rs number . 

1 29. (Currently amended) The apparatus according to Claim 28, wherein the network data 

2 instances are include datagrams as part of a UDP/IP (User Datagram Protocol/Internet 

3 Protocol) network. 

1 30. (Currently amended) The m e thod a pparatus according to Claim 1 8, wherein the 

2 signature is truncated to include fewer bits than the hash function output string. 
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1 31. (Currently amended) The m e thod apparatus according to Claim 1 8, wherein flag bits 

2 are added to the signature which indicate the a type of application associated with the 

3 network data instance. 

1 32. (Currently amended) The m e thod apparatus according to Claim 20, wherein the 

2 monitor monitoring device serves as a data reduction device for the data report and 

3 the signature information being sent to the central data coll e ctor collection device . 

1 33. (Currently amended) A method for providing [[a]] unique signatur e signatures of 

2 monitored network data packets flowing across various connections between 

3 networked devices, the unique signatur e signatures being derived from information 

4 contained entirely within each instance of the network data pack e t packets , the 

5 method comprising: 

6 using at l e ast on e a monitoring device to monitor a network data packet flowing 

7 across at l e ast on e a data connection; 

8 deriving from the data packet a source and destination address for the data packet ; 

9 deriving from the data packet a source and destination port associated with the 

1 0 networked devices; 

1 1 deriving from the data packet at l e ast on e a sequence number associated with the data 

12 instanc e packet ; 

13 assembling the derived addresses, ports, and at l e ast on e the sequence number 

14 information into an input string for a hash function; 

15 using the an output string of the hash function as fee a signature which represents a 

16 unique identifier of the network data packet; 
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attaching the signature to at l e ast on e a data report associated with the network data 
packet; and 

transmitting the data r e ports report and signatur e s signature from eaeh the monitoring 
device to a central collecting device for analysis. 



Case 22501-05465 (Amendment C) 
U.S. Serial No. 09/693,798 



8 



22501/05465/DOCS/1554830.1 



